Red Hat Enterprise Linux (RHEL)
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Red Hat Enterprise Linux (RHEL).
Recent Red Hat Enterprise Linux (RHEL) Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2026:96333 | (RHSA-2026:96333) Red Hat Enterprise Linux AI 3.5.3 enhancement update | November 9, 2026 |
| RHSA-2026:96323 | (RHSA-2026:96323) Red Hat Enterprise Linux AI 3.5.3 enhancement update | November 9, 2026 |
| RHSA-2026:95222 | (RHSA-2026:95222) Ansible automation portal Red Hat Enterprise Linux Images | November 4, 2026 |
| RHSA-2026:92452 | (RHSA-2026:92452) Red Hat Enterprise Linux AI 3.5.2 enhancement update | October 29, 2026 |
| RHSA-2026:92449 | (RHSA-2026:92449) Red Hat Enterprise Linux AI 3.5.2 enhancement update | October 29, 2026 |
| RHSA-2026:90440 | (RHSA-2026:90440) Red Hat Enterprise Linux AI 3.4.6 security update | October 26, 2026 |
| RHSA-2026:90432 | (RHSA-2026:90432) Red Hat Enterprise Linux AI 3.4.6 security update | October 26, 2026 |
| RHSA-2026:76150 | (RHSA-2026:76150) Red Hat Enterprise Linux AI 3.4.5 security update | October 5, 2026 |
| RHSA-2026:76149 | (RHSA-2026:76149) Red Hat Enterprise Linux AI 3.4.5 security update | October 5, 2026 |
| RHSA-2026:76043 | (RHSA-2026:76043) Red Hat Enterprise Linux AI 3.3.7 security update | October 5, 2026 |
By the Year
In 2026 there have been 1432 vulnerabilities in Red Hat Enterprise Linux (RHEL) with an average score of 7.0 out of ten. Last year, in 2025 Enterprise Linux (RHEL) had 213 security vulnerabilities published. That is, 1219 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.43.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 1432 | 6.95 |
| 2025 | 213 | 6.52 |
| 2024 | 172 | 6.36 |
| 2023 | 215 | 6.39 |
| 2022 | 176 | 6.84 |
| 2021 | 148 | 6.51 |
| 2020 | 104 | 6.29 |
| 2019 | 293 | 6.18 |
| 2018 | 113 | 7.01 |
It may take a day or so for new Enterprise Linux (RHEL) vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Enterprise Linux (RHEL) Security Vulnerabilities
Ansible Posix authorized_key Symlink Path Traversal
CVE-2026-126644
3.9 - Low
- November 12, 2026
A link-following flaw was found in the authorized_key module of the ansible.posix collection, residual to the fix for CVE-2026-11837. That fix guards only the final path component (os.chown with follow_symlinks=False and O_NOFOLLOW in _safe_open_write()). When an unprivileged local user replaces their ~/.ssh directory with a symlink to a directory they do not own, and an operator subsequently runs the authorized_key task as root (a common provisioning pattern), the module resolves its path operations through the symlink: atomic_move() writes the temporary file in the symlink target and renames it to <target>/authorized_keys, creating or overwriting a file in the attacker-chosen directory, and os.chmod(sshdir, 0o700) follows the symlink and changes the target directory's permissions. The written file is chowned to the unprivileged user, so this is not a privilege escalation, but it allows an attacker to create or overwrite files (for example in /etc/apt/apt.conf.d/, which APT reads regardless of file ownership) to cause integrity and availability impacts.
insecure temporary file
Cockpit symlink deref privilege escalation (ssh-add-public-key.sh)
CVE-2026-91151
7.3 - High
- November 11, 2026
A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.
insecure temporary file
XFSprogs xfs_admin Command Injection (Local PrivEsc)
CVE-2026-108472
7.8 - High
- November 11, 2026
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.
Shell injection
Cockpit WebSocket Fragmentation DoS via Unbounded Memory Exhaustion
CVE-2026-91150
7.5 - High
- November 11, 2026
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the `cockpit-ws` service.
Allocation of Resources Without Limits or Throttling
Directory Traversal in pappl-retrofit PPD handling
CVE-2026-123747
7.3 - High
- November 11, 2026
A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.
Directory traversal
Podman Auto-Update Metadata Label DoS via Malicious Image
CVE-2026-121885
6.5 - Medium
- November 10, 2026
A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container and auto-update processes it, arbitrary system services are restarted with the user's privileges, potentially allowing an attacker to shut down the host system when Podman runs with administrative privileges.
Reliance on Untrusted Inputs in a Security Decision
libstdc++ buffer overflow on failed bytebybyte writes (DoS/Corruption)
CVE-2026-125709
4.2 - Medium
- November 10, 2026
A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigger a buffer overflow, potentially resulting in a Denial of Service (DoS) or memory corruption.
Memory Corruption
GStreamer MXF Demuxer Off-by-One Write
CVE-2026-125707
6.1 - Medium
- November 10, 2026
A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-byte write past the logical end of a temporal offset array. This may corrupt memory and cause the application to crash. The extent of the impact has not been demonstrated by a runtime test.
Memory Corruption
GStreamer gst-plugins-bad OOB Read DoS in MPEG PS Demuxer
CVE-2026-125706
5.5 - Medium
- November 10, 2026
A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an out-of-bounds read and potentially crash the application, resulting in a denial of service.
Out-of-bounds Read
GStreamer gst-plugins-base RTCP SDES parser buffer overflow
CVE-2026-125712
7.5 - High
- November 10, 2026
A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer, potentially crashing the application or exposing a limited amount of process memory.
Out-of-bounds Read
OOB Read/Write in GStreamer gst-plugins-bad MXF Plugin Leads to DoS
CVE-2026-125703
5.5 - Medium
- November 10, 2026
A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing affected content may crash the application, resulting in a denial of service.
Improper Input Validation
Cockpit Storaged CURL Option Injection via Tang Keyserver
CVE-2026-125672
6.6 - Medium
- November 10, 2026
A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user.
Argument Injection
GStreamer Core Buffer Use-After-Free in Deserialization
CVE-2026-125704
7.5 - High
- November 10, 2026
A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash. A network-facing GStreamer Data Protocol receiver can process such caps data without user interaction; further impact has not been established.
Dangling pointer
OpenSCAP heap buffer overflow via XCCDF sds-compose (DoS)
CVE-2026-122056
5.9 - Medium
- November 09, 2026
A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corrupt memory, resulting in an application crash and a Denial of Service (DoS).
Memory Corruption
MIT Kerberos 5 RPC client memory leak DoS via clnttcp_call
CVE-2026-112314
7.5 - High
- November 09, 2026
clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.
Missing Release of Resource after Effective Lifetime
MIT Kerberos krb5 AUTH_GSSAPI DoS via Memory Exhaustion
CVE-2026-112321
7.5 - High
- November 09, 2026
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.
Missing Release of Resource after Effective Lifetime
MIT Kerberos 5 (krb5) 1.4+ GSS-RPC auth context leak DoS
CVE-2026-112320
7.5 - High
- November 09, 2026
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
Missing Release of Resource after Effective Lifetime
MIT Kerberos krb5 GSS-RPC XDR OOB DoS via unbounded allocation
CVE-2026-112319
6.5 - Medium
- November 09, 2026
The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding.
Allocation of Resources Without Limits or Throttling
MIT Kerberos 5 1.5.3+ RPC policy NULL name DoS
CVE-2026-112318
6.5 - Medium
- November 09, 2026
The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code.
NULL Pointer Dereference
MIT Kerberos 5 kadmind DoS via XDR decode memory leak
CVE-2026-112316
6.5 - Medium
- November 09, 2026
xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure.
Missing Release of Resource after Effective Lifetime
MIT Kerberos 5 1.2.8+ keytab memory leak in KDC/kadmind (DoS)
CVE-2026-112317
5.3 - Medium
- November 09, 2026
krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures.
Missing Release of Resource after Effective Lifetime
MIT Kerberos 5 1.4+ RPCSEC_GSS auth memory leak DoS
CVE-2026-112315
5.3 - Medium
- November 09, 2026
The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages.
Missing Release of Resource after Effective Lifetime
MIT Kerberos 5 1.11+ DoS via decode_sequence_of() CPU consumption
CVE-2026-119079
7.5 - High
- November 09, 2026
decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.
Incorrect Behavior Order: Early Amplification
MIT Kerberos 5 1.5.2+ GSSAPI Auth DoS (memory exhaustion)
CVE-2026-112323
7.5 - High
- November 09, 2026
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.
Missing Release of Resource after Effective Lifetime
MIT Kerberos 5 GSSAPI svc_auth_gssapi.c DoS via quadratic CPU consumption
CVE-2026-112322
7.5 - High
- November 09, 2026
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
Allocation of Resources Without Limits or Throttling
GStreamer gst-plugins-good MOV/MP4 demuxer OOB heap read DoS
CVE-2026-125041
5.5 - Medium
- November 09, 2026
A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the declared row alignment and chroma geometry before using them to build a video buffer layout. A crafted file can cause an out-of-bounds heap read while the sample is copied, potentially crashing the application and causing denial of service.
Improper Validation of Specified Quantity in Input
GStreamer gst-plugins-base SRT/WebVTT Subtitle Parser Regex DoS
CVE-2026-125040
6.5 - Medium
- November 09, 2026
A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.
ReDoS
Ansible-Core git module argument injection (CVE-2026-84503)
CVE-2026-84503
6.7 - Medium
- November 09, 2026
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.
Argument Injection
GStreamer gst-plugins-bad HEVC parser useofuninitialized memory DoS
CVE-2026-121611
6.5 - Medium
- November 09, 2026
A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content.
Use of Uninitialized Variable
GStreamer MXF demuxer OOB read & DoS (gst-plugins-bad)
CVE-2026-121601
6.1 - Medium
- November 09, 2026
A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.
Out-of-bounds Read
GStreamer gst-plugins-good H.264 RTP depayloader OOB heap read (CVE-2026-119610)
CVE-2026-119610
8.2 - High
- November 09, 2026
A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflow to a large positive value when the packet is truncated. This allows a remote, unauthenticated attacker to trigger an out-of-bounds heap read of up to approximately 64 KiB of process memory by sending a single malformed RTP packet. Successful exploitation can crash the receiving GStreamer pipeline (denial of service), and in relay or transcoding deployments where output is accessible to the attacker, may expose adjacent heap contents.
Out-of-bounds Read
GStreamer Adaptive Streaming Demuxer Unrestricted URI Scheme File Read
CVE-2026-121629
7.5 - High
- November 09, 2026
A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, URIs referenced in the manifest content are fetched without restricting which URI schemes are permitted. An attacker who controls a manifest URL, or who can inject content into an HTTP manifest response, can include file:// URIs pointing to arbitrary local files, causing the affected application to read and process those files. In automated or server-side deployments such as media recorders, proxies, and downloaders, this can lead to disclosure of sensitive local files. Existence of files can also be inferred through differing error responses even when content is not directly observable.
External Control of File Name or Path
Podman seccomp AF_VSOCK/NETLINK_AUDIT bypass via 64-bit int truncation
CVE-2026-123876
4.4 - Medium
- November 06, 2026
A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.
Denylist / Deny List
D-Bus Daemon DoS via Driver Broadcast Delivery Failure
CVE-2026-120749
6.2 - Medium
- November 06, 2026
A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon.
assertion failure
Ansiblecore User Module Symlink PrivEsc via SSH Key Generation
CVE-2026-123037
6.7 - Medium
- November 06, 2026
A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902.
insecure temporary file
GDB Remote Debug Target Stack Buffer Overflow (CVE-2026-123151)
CVE-2026-123151
7.5 - High
- November 05, 2026
A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB.
Stack Overflow
Heap Buffer Overflow in gdbserver QTDPsrc packet leads to RCE
CVE-2026-121997
8.1 - High
- November 05, 2026
A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.
Heap-based Buffer Overflow
gdbserver agent-expression parser length validation OOB read/DoS
CVE-2026-121996
8.2 - High
- November 05, 2026
A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation.
Untrusted Pointer Dereference
GDB client tracepoint upload stack buffer overflow (CVE-2026-121995)
CVE-2026-121995
7.5 - High
- November 05, 2026
A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer.
Stack Overflow
GDB remote protocol stack buffer overflow (CVE-2026-121994)
CVE-2026-121994
8.8 - High
- November 05, 2026
A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetch_register_using_p, which decodes a stub's register reply into an alloca-sized buffer without bounding writes by the register width.
Stack Overflow
GStreamer gst-plugins-bad JPEG2000 Int Overflow (CVE-2026-121259)
CVE-2026-121259
6.5 - Medium
- November 03, 2026
A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service.
Integer Overflow or Wraparound
GStreamer gst-plugins-good FLV Demuxer Buffer Size Validation Bypass
CVE-2026-119843
6.5 - Medium
- November 03, 2026
A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availability when processing enhanced audio and video tags in malformed or truncated FLV streams. A remote attacker could exploit this vulnerability by providing a specially crafted FLV media file that, when opened or streamed by a GStreamer-based application, triggers an assertion failure or a process crash, leading to denial of service.
assertion failure
Queue Pointer Corruption in libslirp => Host DoS via Burst Traffic
CVE-2026-120831
6.5 - Medium
- November 03, 2026
A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host networking process, causing a denial of service.
Memory Corruption
libslirp ICMP error out-of-bounds heap read in Red Hat QEMU
CVE-2026-120830
7.4 - High
- November 03, 2026
A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.
Out-of-bounds Read
Red Hat Hivex OOB Read via Malformed Registry Hive
CVE-2026-120740
2 - Low
- November 02, 2026
A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application processing the registry file to crash, resulting in a Denial of Service (DoS).
Out-of-bounds Read
json-glib Denial of Service via Infinite Loop in JSONPath Slice Evaluator
CVE-2026-120194
7.5 - High
- October 31, 2026
A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.
Infinite Loop
GStreamer gst-plugins-base: MicroDVD Subtitle Parser NULL Deref Crash
CVE-2026-119842
6.5 - Medium
- October 30, 2026
A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD (.sub) subtitle file.
NULL Pointer Dereference
GStreamer gst-plugins-bad H.265 SCC Parser Integer Underflow
CVE-2026-119727
6.5 - Medium
- October 30, 2026
A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. An attacker can deliver the malformed bitstream as a local file or over a network stream such as HTTP, HLS, DASH, RTSP, RTP, or WebRTC. Successful exploitation requires the application to open or play that content, and is limited to a denial-of-service impact.
Heap-based Buffer Overflow
GStreamer AV1 LEB128 Integer Overflow in Variable-Length Integer Parser
CVE-2026-119729
6.5 - Medium
- October 30, 2026
A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service.
Integer Overflow or Wraparound
NULL PTR Deref in gst-plugins-bad H.264 Parser Causes DoS
CVE-2026-119728
6.5 - Medium
- October 30, 2026
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.
NULL Pointer Dereference
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Red Hat Enterprise Linux (RHEL) or by Red Hat? Click the Watch button to subscribe.
